Press play to start listening
Cybersecurity firm Morphisec has uncovered a new Windows infostealer called RevStealer, which is being distributed through a fake desktop application claiming to offer free access to Anthropic’s Claude Opus 5.
During the research, shared with Hackread.com, Morphisec found the campaign using social engineering tactics to direct victims to GitHub repositories and game cheat (mods) themed websites. The main lure is claude5opus/Claude-Opus-5-Free-Desktop, which impersonates Anthropic and offers a roughly 101 MB download named ClaudeOpus5-desktop.zip.
How the Attack Starts
When a victim runs the fake app, an Electron-based loader takes over. Morphisec identified it as Electron 33.4.11 running on Chromium 130.0.6723.191. XabivSystem.exe opens an app.asar archive and runs electron/snmc.js without showing a window.
For context, Electron is a software framework that lets developers build cross-platform desktop applications using web technologies like JavaScript, HTML, and CSS.
The loader first checks the computer for at least 2 GiB of physical memory and two logical CPU cores, along with specific hostnames, usernames, and graphics hardware. If the checks pass, it uses an encoded PowerShell command to try to add %USERPROFILE%\AppData to Microsoft Defender’s exclusion list.
It then decrypts the malicious resource resources\app-ri9icle2.res using AES-256-CBC, producing a 3.4 MB Windows PE file. The file is written to AppData and launched without a visible window, after which the loader attempts to delete it.
What RevStealer Targets
According to Morphise ‘s blog post, the native payload uses 14 indirect system-call wrappers to reach Windows functions while avoiding exported entry points where user-mode monitoring hooks are commonly placed. It also checks for virtual machines, sandboxes, and analysis tools using process, CPU, memory, uptime, and graphics indicators. Certain regional language settings can also cause it to terminate.
For browser theft, RevStealer uses DPAPI to recover Chromium’s encryption key and a hardware breakpoint to capture App-Bound encryption keys from Chrome and Edge processes. It mainly targets browser databases and extensions, including MetaMask, Phantom, Coinbase Wallet, Bitwarden, 1Password and LastPass.
It also searches for Windows Credential Manager, password managers, more than 50 cryptocurrency wallets, VPN and remote-access data, FTP credentials, messaging and game apps, clipboard contents, screenshots and selected documents.
Polygon Provides C2 Failover
The stolen information is packaged into records, encrypted with AES-128-CBC, and sent to the attackers over HTTPS. RevStealer does not first bundle everything into a large archive on the computer. Instead, it sends the collected data in separate batches, leaving less data behind on the infected machine.
If its primary C2 becomes unavailable, the malware queries a Polygon smart contract through public RPC providers. The contract provides an alternative server address, allowing the operator to rotate infrastructure without rebuilding the malware. After completing its tasks, RevStealer sends a completion signal and attempts to delete its executable using Windows file-disposition mechanisms.
The findings show the risks of downloading unofficial software, particularly applications promising free access to paid AI services. Morphisec’s analysis also shows that RevStealer is designed to minimize traces on an infected system and leave fewer artifacts for defenders to investigate.
The infostealer’s combination of anti-analysis checks, indirect system calls, its use of in-memory buffers and streamed exfiltration, and blockchain-based C2 failover makes early prevention particularly important.
